Embed the OpenAPI spec (or its hash) for provenance

[onetechgroupll]

From the SDK review 2026-09-15.

Evidence: only goadserver-go embeds api/openapi.yaml. For this repo, which spec revision generated it is only provable via commit messages.

Fix: embed openapi.yaml here too, or at minimum stamp the spec hash + generator version into the README on each regeneration.